Exchange ProxyShell: Domain-Wide Ransomware
An internet-facing Exchange server falls to ProxyShell, dropping ASPX web shells that run as SYSTEM. The attacker re-enables a built-in account, dumps LSASS with a Windows DLL, tunnels out with Plink and FRP, moves laterally over RDP, and encrypts the domain with its own BitLocker and DiskCryptor, no ransomware binary in sight. Work the Exchange logs, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
20Overnight, the internet-facing Exchange server generated web traffic that never belonged to any mailbox user. Work the Exchange/IIS request logs and isolate the external address behind the requests that abused Autodiscover to reach the server's backend PowerShell endpoint.
Name the implant
20The exploitation wrote something into the Exchange web application that the attacker kept coming back to. Identify the file planted in the Exchange OWA auth web tree.
Catch the privileged account
25Through the planted page the attacker gave themselves a durable, privileged way back in using an account that should never be active. Identify the built-in account that was re-enabled and added to local Administrators.
Expose the credential theft
25With SYSTEM on the Exchange box, the attacker stole credentials without dropping a recognizable hacking tool. Identify the file written to disk that holds the harvested credential material.
Trace the tunnel out
20The DMZ Exchange host began initiating outbound sessions it had no business making, to keep the operator connected. Identify the external relay the reverse tunnels reached out to.
Classify the impact
15No ransomware executable was ever found, yet the estate was encrypted end to end. Map the final impact to its MITRE ATT&CK technique.
6 tasks · 125 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.